Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1068
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.appj####.com:80
- TCP(HTTP/1.1) wz.3####.com:80
- TCP(HTTP/1.1) bo####.hua####.com:80
- TCP(HTTP/1.1) app.j####.com:80
- TCP(HTTP/1.1) 2####.186.12.235:39870
- TCP(HTTP/1.1) c####.360.cn:80
- TCP(HTTP/1.1) www.j####.com:80
- TCP(HTTP/1.1) 2####.186.12.235:39871
- TCP(HTTP/1.1) app.3####.com:80
- TCP(HTTP/1.1) 3.i####.com:80
- TCP(HTTP/1.1) www.sm####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) o####.b####.cn:80
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) c.c####.com:443
DNS requests:
- 3.i####.com
- api.s####.b####.com
- app.3####.com
- app.j####.com
- bo####.hua####.com
- c####.360.cn
- c####.mm####.com
- c.appj####.com
- c.c####.com
- hm.b####.com
- m.b####.com
- o####.b####.cn
- p####.zhanz####.b####.com
- s23.c####.com
- www.3####.com
- www.j####.com
- www.sm####.com
- wz.3####.com
- wz.j####.com
- z5.c####.com
HTTP GET requests:
- 3.i####.com/jdhlhmu.js
- 3.i####.com/production/openjs/kfxclunnb.js?kfx=####
- app.3####.com/datacache/type_684.js?jsoncallback=####&_=####
- app.3####.com/datacache/type_756.js?jsoncallback=####&_=####
- app.j####.com/datacache/type_684.js?jsoncallback=####&_=####
- app.j####.com/datacache/type_756.js?jsoncallback=####&_=####
- app.j####.com/uploadfile/2015/1126/20151126030744115.png
- app.j####.com/uploadfile/2016/0517/20160517102555167.png
- app.j####.com/uploadfile/2016/1031/20161031111922662.png
- app.j####.com/uploadfile/2017/0317/20170317051814808.png
- app.j####.com/uploadfile/2017/0818/20170818053137207.png
- app.j####.com/uploadfile/2017/0828/20170828025852832.jpg
- app.j####.com/uploadfile/2017/0829/20170829083722916.png
- app.j####.com/uploadfile/2017/1018/20171018052051515.png
- app.j####.com/uploadfile/2017/1107/20171107053906724.jpg
- app.j####.com/uploadfile/2017/1124/20171124023108688.png
- app.j####.com/uploadfile/2017/1124/20171124092613926.jpg
- bo####.hua####.com/smu0/c.js?l=####
- bo####.hua####.com/smu0/h.html
- bo####.hua####.com/smu0/j.html
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?l=####
- www.j####.com/uploadfile/2017/0802/20170802041732112.png
- www.j####.com/uploadfile/2017/0802/20170802041732232.png
- www.j####.com/uploadfile/2017/0802/20170802041732818.png
- www.sm####.com/smu0/o.js
- wz.3####.com/api.php?op=####&id=####&modelid=####
- wz.3####.com/api.php?op=####&id=####&module=####
- wz.3####.com/article/Mobile/sort0508/133681.html
- wz.3####.com/favicon.ico
- wz.3####.com/index.php?m=####&c=####&a=####&commentid=####
- wz.3####.com/index.php?m=####&c=####&a=####&page=####&pagesize=####&comm...
- wz.3####.com/statics/v4/css/public.css
- wz.3####.com/statics/v4/css/style.css
- wz.3####.com/statics/v4/images/back.png
- wz.3####.com/statics/v4/images/dan.png
- wz.3####.com/statics/v4/images/dot.png
- wz.3####.com/statics/v4/images/h5.png
- wz.3####.com/statics/v4/images/home.png
- wz.3####.com/statics/v4/images/wyou.png
- wz.3####.com/statics/v4/images/yong.png
- wz.3####.com/statics/v4/images/zhun.png
- wz.3####.com/statics/v4/images/zoom2.png
- wz.3####.com/statics/v4/images/zxin.png
- wz.3####.com/statics/v4/js/global.js
- wz.3####.com/statics/v4/js/jquery-1.8.3.min.js
- wz.3####.com/statics/v4/js/show_comment.js
- wz.3####.com/statics/v4/js/swiper-3.4.2.min.js
- wz.3####.com/uploadfile/2017/0802/20170802041732112.png
- wz.3####.com/uploadfile/2017/0802/20170802041732232.png
- wz.3####.com/uploadfile/2017/0802/20170802041732818.png
HTTP POST requests:
- c####.360.cn/stra_packet
- c.appj####.com/ad/splash/stats.html
- o####.b####.cn/7/find
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/.jgrpa.xml
- /data/data/####/.log.lock
- /data/data/####/.log.rpa
- /data/data/####/ad_show_time.xml
- /data/data/####/bmob_sp.xml
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/libjiagu-1158399031.so
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu-1158399031
Uses the following algorithms to encrypt data:
- RSA
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
